How does Spamhaus decide whether to list a subdomain or a whole domain on the DBL?

Key findings

• Conditional listing: Spamhaus does not have a strict 'always subdomain' or 'always whole domain' policy; the listing depends on the specific circumstances of the abuse.
• Scope of abuse: If spamming activity is observed across multiple subdomains, Spamhaus may opt to list the entire root domain. Conversely, if abuse is isolated to a specific subdomain and the root domain is otherwise legitimate and compromised, only the subdomain may be listed.
• Compromised vs. illegitimate: For domains identified as legitimate but compromised, Spamhaus tends to list only the specific subdomain exhibiting the compromise. If the entire domain is deemed illegitimate or primarily used for spam, both the subdomain and the root domain may be listed.
• Evolution of DBL: The DBL has evolved to include hostnames for greater accuracy, particularly in cases of abused but otherwise legitimate domains.
• Not triggered by single spam traps: A single spam trap hit is generally insufficient to trigger a DBL listing. Listings are typically based on patterns of abusive behavior or direct spam reports from real users.

Key considerations

• Proactive monitoring: Regularly monitor your domain and its subdomains for any signs of compromise or unusual sending activity to prevent a blocklist event. Tools that provide blocklist monitoring can be invaluable here.
• Review send practices: Ensure your email sending practices comply with best practices, including proper list hygiene and permission-based sending, to avoid being flagged by Spamhaus.
• Understand listing reasons: Familiarize yourself with the common reasons for Spamhaus listings, which can range from sending to spam traps to direct spam reports.
• Immediate action: If you find your domain or subdomain listed, take swift action to identify and resolve the underlying issue. Spamhaus provides resources, such as their resource center on DBL and hostnames, to assist with delisting procedures after remediation.

Key opinions

• Subdomain safety: Many marketers believe that using subdomains for different sending purposes (e.g., transactional, marketing) offers an inherent safety net, as it might limit blocklist impact to only the problematic subdomain.
• Spam trap confusion: There's a common misconception that a single spam trap hit can immediately lead to a Spamhaus DBL listing, leading to heightened anxiety about list hygiene.
• Low complaint rate puzzle: Marketers are often puzzled when they receive a DBL listing despite maintaining very low complaint rates, as reported by tools like Google Postmaster Tools. They wonder if Spamhaus uses different metrics.
• Delisting challenges: Marketers frequently express frustration over the perceived difficulty in getting delisted and understanding the specific reasons for their listing, especially when they believe they are sending legitimate email.

Key considerations

• Strategic subdomain use: While subdomains can help isolate reputation, they are not a guaranteed shield against a root domain listing if widespread abuse is detected. For more details on this, see Does Spamhaus DBL list hostnames or root domains?
• Beyond spam traps: Focusing solely on spam traps can be misleading. Spamhaus utilizes various data points, including direct spam reports, to make listing decisions. Understanding the full scope of triggers can help improve domain reputation.
• Complaint rate vs. listing: Recognize that high or low complaint rates in Google Postmaster Tools do not directly correlate with Spamhaus listings. Different blocklists operate on different criteria and data sources.
• Persistence in delisting: When listed, marketers need to be persistent in communicating with Spamhaus and demonstrating that underlying issues have been resolved. Forum discussions, such as those on Mail-in-a-Box Forum, highlight the real-world challenges faced by marketers.

Key opinions

• Flexible listing approach: Experts confirm that Spamhaus's DBL listing policy is not rigidly fixed on either subdomains or entire domains, adapting based on the observed abuse.
• Whole domain for widespread abuse: If spam activity involves multiple subdomains, it indicates a broader issue, leading Spamhaus to list the entire root domain for greater effectiveness.
• Targeted listings for ESPs: Recent changes in DBL policy allow for more selective listings of ESP click and image links, preventing the blocklisting of an entire ESP due to isolated abuse.
• Single company implication: For a single company, there's less incentive for Spamhaus to be selective; if a subdomain is abused, the entire domain might be listed if the abuse is clearly linked to the main entity.
• Spam traps are not primary triggers: A single spam trap hit is not enough to get listed on Spamhaus. Listings are typically for more significant patterns of abuse.
• Real person spam reports: Spamhaus can indeed list domains based on spamming a single, real person, including Spamhaus editors themselves, highlighting the human element in their detection.
• Complaint rates not indicative: Complaint rates (e.g., from Google Postmaster Tools) do not directly correlate with Spamhaus listings, as their criteria and data sources are often different.
• Type of listing matters: The determination of whether only a subdomain or both are listed depends on if Spamhaus views the domain as compromised but legitimate, or if it is inherently non-legitimate and used for abuse.

Key considerations

• Behavioral analysis: Understand that Spamhaus considers the overall pattern of sending behavior. A consistent pattern of malicious activity across multiple subdomains could easily lead to a root domain blocklisting, as discussed in What causes Spamhaus blacklisting and how to resolve it?.
• Direct communication: Engaging directly with Spamhaus, as detailed in How to contact Spamhaus directly for DBL delisting, can be effective, especially if a listing stems from direct spam reports.
• Comprehensive understanding of DBL: It is important to grasp the various categories and criteria Spamhaus uses for its DBL, which may differ from other reputation metrics. Industry blogs, like Word to the Wise, often provide insightful analyses.
• Focus on root causes: Rather than fixating on the type of listing (subdomain vs. root), prioritize identifying and remediating the root cause of the abusive sending behavior.

Key findings

• Domain-focused: The Spamhaus DBL primarily lists domains, distinguishing itself from IP-based blocklists like the SBL. This allows for targeting domains used in spam, phishing, or malware.
• Hostnames included: Spamhaus has incorporated hostnames into the DBL's 'abused-legit' section to enhance accuracy, enabling more precise blocklisting when only specific hostnames are compromised.
• Complex rule sets: The decision to list a domain or subdomain is based on a complex set of rules and draws inputs from multiple sources, indicating a sophisticated detection mechanism.
• Comprehensive threat intelligence: Spamhaus employs various methods, including spam traps, honeypots, and direct reports, to identify and classify domains involved in abusive activities.

Key considerations

• Layered protection: The DBL acts as a critical layer of protection by targeting domains, complementing IP-based blocklists and contributing to overall email security, as outlined in Email on Acid's guide to Spamhaus.
• Adapting to changes: Marketers should stay informed about changes to the DBL, such as the inclusion of hostnames, as these updates can impact how their domains are assessed. For more information, read about what the changes to the Spamhaus DBL mean.
• Proactive security measures: Implement strong security practices to prevent domain compromise, as this is a key factor in targeted subdomain listings. This includes using robust passwords and timely software updates.